Selectively prioritizing alerts received for an advanced cybersecurity threat prioritization system

Abstract

A computer-implemented method, according to one approach includes having a historical risk score generated for a current cybersecurity event in response to detecting the current cybersecurity event. A sigma rule detection score is also generated for the current cybersecurity event, in addition to an anomaly risk score that is generated for the current cybersecurity event. An IoC score is further generated for the current cybersecurity event. A machine learning model is used to evaluate the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. The machine learning model is also used to create a consolidated risk score corresponding to: the current cybersecurity event, the consolidated risk score incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score.

What is claimed is: 
     
         1 . A computer-implemented method, comprising, in response to detecting a current cybersecurity event:
 causing a historical risk score to be generated for the current cybersecurity event;   causing a sigma rule detection score to be generated for the current cybersecurity event;   causing an anomaly risk score to be generated for the current cybersecurity event;   causing an Indicator of Compromise (IoC) score to be generated for the current cybersecurity event; and   using a machine learning model to:
 evaluate the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score, and 
 create a consolidated risk score corresponding to: the current cybersecurity event, the consolidated risk score incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. 
   
     
     
         2 . The computer-implemented method of  claim 1 , wherein causing the historical risk score to be generated for the current cybersecurity event includes:
 using a second machine learning model to compare the current cybersecurity event to historical cybersecurity events; and   determining the historical risk score based at least in part on the comparison and the corresponding responses to the historical cybersecurity events.   
     
     
         3 . The computer-implemented method of  claim 2 , wherein determining the historical risk score includes:
 applying a time decay to the historical cybersecurity events and the corresponding responses.   
     
     
         4 . The computer-implemented method of  claim 1 , wherein causing the sigma rule detection score to be generated for the current cybersecurity event includes:
 identifying a number of rules that have been fired as a result of the current cybersecurity event;   determining a risk score based at least in part on the number of fired rules; and   normalizing the determined risk score.   
     
     
         5 . The computer-implemented method of  claim 1 , wherein causing the anomaly risk score to be generated for the current cybersecurity event includes:
 inspecting information associated with the current cybersecurity event;   identifying anomalies in the information; and   determining a numeric value for each of the anomalies, the numeric values indicating an amount that the respective anomaly deviates from a majority of the information associated with the current cybersecurity event.   
     
     
         6 . The computer-implemented method of  claim 1 , wherein causing the IoC score to be generated for the current cybersecurity event includes:
 inspecting information associated with the current cybersecurity event;   identifying one or more types of IoCs in the information;   comparing the identified IoCs to information associated with historical cybersecurity events; and   determining the IoC score based at least in part on overlaps between the identified IoCs and the information associated with the historical cybersecurity events,   wherein the one or more types of IoCs identified in the information are determined based on the current cybersecurity event.   
     
     
         7 . The computer-implemented method of  claim 1 , wherein using the machine learning model to create the consolidated risk score includes:
 generating a weighted value for each of: the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score;   applying the weighted values to the respective historical risk score, sigma rule detection score, anomaly risk score, and IoC score; and   combining the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score to form the consolidated risk score.   
     
     
         8 . The computer-implemented method of  claim 7 , wherein the machine learning model is trained using random forest classifiers and/or permutation importance algorithms to generate weighted values for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. 
     
     
         9 . The computer-implemented method of  claim 1 , wherein the operations are performed by an advanced threat prioritization system having a historical risk score module configured to generate the historical risk score, a sigma rule detection score module configured to generate the sigma rule detection score, an anomaly risk score module configured to generate the anomaly risk score, and an IoC score module configured to generate the IoC score. 
     
     
         10 . A computer program product, comprising a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a processor, executable by the processor, or readable and executable by the processor, to cause the processor to, in response to detecting a current cybersecurity event:
 cause a historical risk score to be generated for the current cybersecurity event;   cause a sigma rule detection score to be generated for the current cybersecurity event;   cause an anomaly risk score to be generated for the current cybersecurity event;   cause an Indicator of Compromise (IoC) score to be generated for the current cybersecurity event; and   use a machine learning model to:
 evaluate the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score, and 
 create a consolidated risk score corresponding to: the current cybersecurity event, the consolidated risk score incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. 
   
     
     
         11 . The computer program product of  claim 10 , wherein causing the historical risk score to be generated for the current cybersecurity event includes:
 using a second machine learning model to compare the current cybersecurity event to historical cybersecurity events; and   determining the historical risk score based at least in part on the comparison and the corresponding responses to the historical cybersecurity events.   
     
     
         12 . The computer program product of  claim 11 , wherein determining the historical risk score includes:
 applying a time decay to the historical cybersecurity events and the corresponding responses.   
     
     
         13 . The computer program product of  claim 10 , wherein causing the sigma rule detection score to be generated for the current cybersecurity event includes:
 identifying a number of rules that have been fired as a result of the current cybersecurity event;   determining a risk score based at least in part on the number of fired rules; and   normalizing the determined risk score.   
     
     
         14 . The computer program product of  claim 10 , wherein causing the anomaly risk score to be generated for the current cybersecurity event includes:
 inspecting information associated with the current cybersecurity event;   identifying anomalies in the information; and   determining a numeric value for each of the anomalies, the numeric values indicating an amount that the respective anomaly deviates from a majority of the information associated with the current cybersecurity event.   
     
     
         15 . The computer program product of  claim 10 , wherein causing the IoC score to be generated for the current cybersecurity event includes:
 inspecting information associated with the current cybersecurity event;   identifying one or more types of IoCs in the information;   comparing the identified IoCs to information associated with historical cybersecurity events; and   determining the IoC score based at least in part on overlaps between the identified IoCs and the information associated with the historical cybersecurity events,   wherein the one or more types of IoCs identified in the information are determined based on the current cybersecurity event.   
     
     
         16 . The computer program product of  claim 10 , wherein using the machine learning model to create the consolidated risk score includes:
 generating a weighted value for each of: the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score;   applying the weighted values to the respective historical risk score, sigma rule detection score, anomaly risk score, and IoC score; and   combining the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score to form the consolidated risk score.   
     
     
         17 . The computer program product of  claim 16 , wherein the machine learning model is trained using random forest classifiers and/or permutation importance algorithms to generate weighted values for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. 
     
     
         18 . An advanced threat prioritization system, comprising:
 a processor; and   logic integrated with the processor, executable by the processor, or integrated with and executable by the processor, the logic being configured to, in response to detecting a current cybersecurity event:
 cause a historical risk score to be generated for the current cybersecurity event; 
 cause a sigma rule detection score to be generated for the current cybersecurity event; 
 cause an anomaly risk score to be generated for the current cybersecurity event; 
 cause an Indicator of Compromise (IoC) score to be generated for the current cybersecurity event; and 
 use a machine learning model to:
 evaluate the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score, and 
 create a consolidated risk score corresponding to: the current cybersecurity event, the consolidated risk score incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. 
 
   
     
     
         19 . The advanced threat prioritization system of  claim 18 , wherein causing the historical risk score to be generated for the current cybersecurity event includes:
 using a second machine learning model to compare the current cybersecurity event to historical cybersecurity events; and   determining the historical risk score based at least in part on the comparison and the corresponding responses to the historical cybersecurity events,   wherein comparing the current cybersecurity event to the historical cybersecurity events includes comparing features selected from the group consisting of: log severity scores, model escalation probabilities, rare scores, and observable scores.   
     
     
         20 . The advanced threat prioritization system of  claim 18 , wherein causing the sigma rule detection score to be generated for the current cybersecurity event includes:
 identifying a number of rules that have been fired as a result of the current cybersecurity event;   determining a risk score based at least in part on the number of fired rules; and   normalizing the determined risk score.   
     
     
         21 . The advanced threat prioritization system of  claim 18 , wherein causing the anomaly risk score to be generated for the current cybersecurity event includes:
 inspecting information associated with the current cybersecurity event;   identifying anomalies in the information; and   determining a numeric value for each of the anomalies, the numeric values indicating an amount that the respective anomaly deviates from a majority of the information associated with the current cybersecurity event.   
     
     
         22 . The advanced threat prioritization system of  claim 18 , wherein causing the IoC score to be generated for the current cybersecurity event includes:
 inspecting information associated with the current cybersecurity event;   identifying one or more types of IoCs in the information;   comparing the identified IoCs to information associated with historical cybersecurity events; and   determining the IoC score based at least in part on overlaps between the identified IoCs and the information associated with the historical cybersecurity events,   wherein the one or more types of IoCs identified in the information are determined based on the current cybersecurity event.   
     
     
         23 . The advanced threat prioritization system of  claim 18 , wherein using the machine learning model to create the consolidated risk score includes:
 generating a weighted value for each of: the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score;   applying the weighted values to the respective historical risk score, sigma rule detection score, anomaly risk score, and IoC score; and   combining the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score to form the consolidated risk score.   
     
     
         24 . A computer-implemented method, comprising:
 training a machine learning module by:
 collecting information associated with (i) different types of cybersecurity events experienced over time, and (ii) actions taken in response to the respective cybersecurity events that were experienced, and 
 inspecting the collected information to develop a comprehensive understanding of risks associated with the different types of cybersecurity events; and 
   causing the trained machine learning model to:
 evaluate newly received cybersecurity events, and 
 generate historical risk scores for the respective new cybersecurity events. 
   
     
     
         25 . A computer-implemented method, comprising:
 training a machine learning model to generate a consolidated risk score for a cybersecurity event by training the machine learning model to:   generate a weighted value for each of: a historical risk score, a sigma rule detection score, an anomaly risk score, and an IoC score;   apply the weighted values to the respective historical risk score, sigma rule detection score, anomaly risk score, and IoC score; and   combine the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score to form the consolidated risk score.